1 // Copyright 2019 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // https://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "sandboxed_api/sandbox2/forkserver.h"
16
17 #include <fcntl.h>
18 #include <sys/socket.h>
19 #include <sys/wait.h>
20 #include <unistd.h>
21
22 #include <string>
23
24 #include "gtest/gtest.h"
25 #include "absl/log/check.h"
26 #include "absl/log/log.h"
27 #include "absl/strings/str_cat.h"
28 #include "sandboxed_api/sandbox2/forkserver.pb.h"
29 #include "sandboxed_api/sandbox2/global_forkclient.h"
30 #include "sandboxed_api/sandbox2/ipc.h"
31 #include "sandboxed_api/testing.h"
32 #include "sandboxed_api/util/raw_logging.h"
33
34 namespace sandbox2 {
35
36 using ::sapi::GetTestSourcePath;
37
38 class IpcPeer {
39 public:
IpcPeer(IPC * ipc)40 explicit IpcPeer(IPC* ipc) : ipc_(ipc) {}
41
SetUpServerSideComms(int fd)42 void SetUpServerSideComms(int fd) { ipc_->SetUpServerSideComms(fd); }
43
44 private:
45 IPC* ipc_;
46 };
47
GetMinimalTestcaseFd()48 int GetMinimalTestcaseFd() {
49 const std::string path = GetTestSourcePath("sandbox2/testcases/minimal");
50 return open(path.c_str(), O_RDONLY);
51 }
52
TestSingleRequest(Mode mode,int exec_fd)53 pid_t TestSingleRequest(Mode mode, int exec_fd) {
54 ForkRequest fork_req;
55 IPC ipc;
56 int sv[2];
57 // Setup IPC
58 PCHECK(socketpair(AF_UNIX, SOCK_STREAM, 0, sv) != -1);
59 IpcPeer{&ipc}.SetUpServerSideComms(sv[1]);
60 // Setup fork_req
61 fork_req.set_mode(mode);
62 fork_req.add_args("/binary");
63 fork_req.add_envs("FOO=1");
64
65 SandboxeeProcess process =
66 GlobalForkClient::SendRequest(fork_req, exec_fd, sv[0]);
67 if (process.main_pid != -1) {
68 VLOG(1) << "TestSingleRequest: Waiting for pid=" << process.main_pid;
69 waitpid(process.main_pid, nullptr, 0);
70 }
71
72 close(sv[0]);
73 return process.main_pid;
74 }
75
TEST(ForkserverTest,SimpleFork)76 TEST(ForkserverTest, SimpleFork) {
77 // Make sure that the regular fork request works.
78 ASSERT_NE(TestSingleRequest(FORKSERVER_FORK, -1), -1);
79 }
80
TEST(ForkserverTest,SimpleForkNoZombie)81 TEST(ForkserverTest, SimpleForkNoZombie) {
82 // Make sure that we don't create zombies.
83 pid_t child = TestSingleRequest(FORKSERVER_FORK, -1);
84 ASSERT_NE(child, -1);
85 std::string proc = absl::StrCat("/proc/", child, "/cmdline");
86
87 // Give the kernel some time to clean up.
88 // Poll every 10ms up to 500 times (5s)
89 bool process_reaped = false;
90 for (int i = 0; i < 500; i++) {
91 if (access(proc.c_str(), F_OK) == -1) {
92 process_reaped = true;
93 break;
94 }
95 usleep(10 * 1000); // 10 ms
96 }
97 EXPECT_TRUE(process_reaped);
98 }
99
TEST(ForkserverTest,ForkExecveWorks)100 TEST(ForkserverTest, ForkExecveWorks) {
101 // Run a test binary through the FORK_EXECVE request.
102 int exec_fd = GetMinimalTestcaseFd();
103 PCHECK(exec_fd != -1) << "Could not open test binary";
104 ASSERT_NE(TestSingleRequest(FORKSERVER_FORK_EXECVE, exec_fd), -1);
105 }
106
TEST(ForkserverTest,ForkExecveSandboxWithoutPolicy)107 TEST(ForkserverTest, ForkExecveSandboxWithoutPolicy) {
108 // Run a test binary through the FORKSERVER_FORK_EXECVE_SANDBOX request.
109 int exec_fd = GetMinimalTestcaseFd();
110 PCHECK(exec_fd != -1) << "Could not open test binary";
111 }
112
113 } // namespace sandbox2
114